CVE-2025-30247: Critical Command Injection Flaw in Western Digital My Cloud NAS Devices

CVE-2025-30247 is a critical command injection flaw in Western Digital My Cloud NAS devices that WD has patched, with a CVSS score of 9.4. According to WD’s advisory, the vulnerability exists in the My Cloud firmware prior to 5.31.108 and allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST request.

This could enable a remote attacker, without physical access, to run commands on the device’s underlying operating system, potentially leading to data theft, device compromise, or network pivoting. For organisations and home users relying on My Cloud for storage, exploitation could grant attackers root-level control of the NAS and expose sensitive files. Western Digital states the fixed version is firmware 5.31.108 and urges users to update promptly to benefit from the latest security fixes. The advisory emphasises updating through the firmware update notification to protect devices. 30 September 2025.